todo.org

Project Status

The status of this implementation is somewhat complete. Iron is complete, Hawk is complete, but lacks a good client API. Oz is partially complete.

Iron

done: Use the “Data.SecureMem” package for hash equality comparisons.

done: password lookup by ID.

Hawk

done: WAI Middlewares

done: bewit generation

done: bewit authentication

http-conduit wrapper

yesod authentication plugin

rename default functions to def and re-export def

client ext –> bytestring

client ext –> (FromJSON a, ToJSON a)

server dlg –> text

WWW-Authenticate header response

expect(Hawk.utils.unauthorized(‘kaboom’).output.headers[‘WWW-Authenticate’]).to.equal(‘Hawk error=”kaboom”’); expect(Hawk.utils.unauthorized(‘kaboom’, { a: ‘b’ }).output.headers[‘WWW-Authenticate’]).to.equal(‘Hawk a=”b”, error=”kaboom”’);

allow pre-calculated payload hashes

payloadHash :: Algorithm or Creds -> ContentType -> ByteString -> PayloadHash

nonce validation helper

client.message.authenticate()

server.authenticateMessage()

helper function for client-side nonce validation

Server responses have the client-generated nonce included, so are usually save from response replays. But if the client response handler is an api endpoint available to attacker, then the client needs to validate nonces.

Oz

A decent client API and ticket endpoints for Oz

General

docs upload command

#!/usr/bin/env nix-shell
#! nix-shell -i bash -p rsync

cd `dirname $0`
rsync -avz dist/doc/html/hsoz rodney.id.au:/srv/www/rodney.id.au/docs

Production testing in a real-world application

remove utf8 partial functions

use more utils from errors package

split up packages

• avoids bring in wai and/or scotty for iron and/or hawk

URIs should be ByteString not Text

ghcjs support

Add to executableDepends in default.nix: ++ (pkgs.lib.optional (compiler != “ghcjs”) [ wreq ]); Then: nix-shell –arg compiler ‘“ghcjs”’

try to upgrade license to LGPL

Need to contact Hammer about derivatives of his work.

Testing

Iron

done: Iron unit tests, same as js impl

More unit tests around invalid passwords/keys/salts

testing key generation

• e.g. is the RNG ok.

Hawk

done: Sunny day unit tests

Implement full suite coming from js impl

interop tests

nix builds of hawk implementations

e.g. javascript, python, go

test harness

design a few test cases

Hackage stuff

specify ‘license-file’ in cabal

cut down ‘description’ in cabal

Hackage doesn’t support formatting in the description text.

set package “stability” attribute

is an obsolete attribute … but

move description into README.md

add README.md as an extra source in cabal

tags

some build-depends lower version bounds maybe?